eduroam Development VC Minutes 2024-07-16 1530 CEST

Attendance

Welcome / Agenda Bashing
- Offer Mike Z espresso.
Blast!RADIUS debrief
- some feedback received - Aruba suggesting moving away from PEAP? Pushback. Possibly because of a “Workaround” suggestion in the Aruba advisory.: Use EAP-TLS instead… https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04662.txt
- German main IT outlet (Heise) - reported ~ 24 h late and thankfully included a sentence “luckily, eduroam is not affected”
- 20 min Video on the attack: https://www.dfn.de/en/blastradius-newsmeldung/
- some wireless vendors have shown interest in eduroam supporting RadSec / RADIUS/TLS. Happy to - certificate-based RADIUS/TLS is a commodity feature on many NRO RADIUS servers. Process for getting certificate from NRO too. What is (intentionally) not supported is the Wi-Fi gear generating certs and CAs on its own and expecting the NRO to accept that as a trust base.
- RADIUS/DTLS document could contain a sentence like “RADIUS equipment should be prepared to be issued a certificate from an external CA” (which is the case both for eduroam and OpenRoaming, too)
- https://loet.bar/products/kritische-infrastruktur-sticker
Upcoming CAT release 2.1.2
- little things trickling in (e.g. updated OS logos)
- plan to push out release by end of this week
- actual switch on cat.eduroam.org later (after holiday period)
- cat.eduroam.org/new is the sneak preview URL, connected to prod DB
Upcoming Meetings